                                  (utils/get-serial))]
                (.write wtr (str infra-serial))
                (.newLine wtr))
-            (catch java.io.FileNotFoundException ex 
+            (catch java.io.FileNotFoundException ex
                (log/warn
                  (i18n/trs
                    (str
                      "Failed to find/load certificate for Puppet Infrastructure Node:"
                      infra-node)))))))
-       (catch java.io.FileNotFoundException ex 
+       (catch java.io.FileNotFoundException ex
          (log/warn (i18n/trs (str infra-nodes-path " does not exist")))))))
 
 (schema/defn generate-ssl-files!

  (when-not (= hostname subject)
    (sling/throw+
      {:kind :hostname-mismatch
       :msg (i18n/tru "Instance name \"{0}\" does not match requested key \"{1}\"" subject hostname)}))

  (when (contains-uppercase? hostname)
    (sling/throw+
      {:kind :invalid-subject-name
       :msg (i18n/tru "Certificate names must be lower case.")}))

  (when-not (re-matches #"\A[ -.0-~]+\Z" subject)
    (sling/throw+
      {:kind :invalid-subject-name
       :msg (i18n/tru "Subject contains unprintable or non-ASCII characters")}))

  (when (.contains subject "*")
    (sling/throw+
      {:kind :invalid-subject-name
       :msg (i18n/tru "Subject contains a wildcard, which is not allowed: {0}" subject)})))

(schema/defn allowed-extension?
  "A predicate that answers if an extension is allowed or not.

   provided then defaults will be used."
  [host-name :- schema/Str
   alt-names :- schema/Str]
  (let [split-alt-names   (split-hostnames alt-names)
        default-alt-names ["puppet"]
        alt-names-list (reduce (fn [acc alt-name]
                                 (if (str/starts-with? alt-name "IP:")
